Files
codex/codex-rs
joeflorencio-openai 73bf181272 Require forced macOS preferences for managed configuration (#46032)
## Why

`CFPreferencesCopyAppValue` also searches user-writable domains. Ordinary user defaults must not supply trusted administrator configuration or override lower requirements layers.

## What changed

- Check `CFPreferencesAppValueIsForced` before reading `config_toml_base64` and `requirements_toml_base64`, and recheck after reading to ignore values that became unforced.
- Wrap returned property-list values as `CFType` and require a `CFString`, returning `InvalidData` for other types without exposing preference contents.

## Testing

Add tests for both preference keys covering unforced and missing values, loss of forced status during a read, preservation of string contents, and rejection of non-string values with diagnostics that omit their contents.

GitOrigin-RevId: 2eff08ba6b073b4c59ca757e054d112d2a5256d0
2026-09-16 21:30:42 +00:00
..